GHSA-7xff-628x-fqq8HighCVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold...
🔗 CVE IDs covered (1)
📋 Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
There is theoretical UAF if the conn is freed while the hci_sync task is running.
Hold refcount to avoid that.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-74529
- https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab
- https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67
- https://git.kernel.org/stable/c/68ffe4265775ed9e09e18e9a3b388740e25257bf
- https://github.com/advisories/GHSA-7xff-628x-fqq8